Complete operational reference
Every procedure and task in one index. Search a service, tool, technique or error; open a result at its exact section.
42 procedures · 514 headings
discovery scanning
TCP Scanning
Service Identification
UDP Scanning
Scan Results and Next Actions
Windows Network Checks
Scanner Alternatives and Web Baseline Checks
service enumeration
FTP Enumeration
SSH Enumeration and Access Validation
SMTP Enumeration
DNS Enumeration
NFS and Unix RPC Enumeration
SMB and MS-RPC Enumeration
SNMP Enumeration
Database Enumeration and Privilege Boundaries
Windows Remote-Access Validation
- RDP baseline: authentication-only check
- RDP host-side inspection: local administrative context
- 1. Listener, service and configured port
- 2. NLA, transport security and policy precedence
- 3. Candidate membership and effective logon rights
- 4. Source-relative validation and decision
- WinRM baseline: interactive session
- VNC
- Telnet
- GNU Inetutils telnetd — conditional authentication-bypass check
HTTP and Web Application Mapping
- Baseline the application identity
- Manual behavior map
- Inspect exposed artifacts
- Discover files and directories
- Discover virtual hosts
- Discover parameters and object values
- Map API methods, schema and authorization
- Exit and handoffs
- wfuzz alternative for paths and form values
- HTTP proxy variables — control which client request goes through Burp
- Extract candidate paths from a downloaded JavaScript file
LDAP and Kerberos Enumeration
SIP and IRC Triage
Memcached and WebDAV
initial access
RDP Access
Web File Read, Inclusion and Upload Paths
- Directory traversal: prove file read
- PHP inclusion: retrieve source
- LFI to command execution through a writable/readable log
- Upload: establish the primitive
- Upload: verify executable handling
- Upload with path control
- Exit and next action
- PHP include control — generate a filter chain when uploads are unavailable
- Image/PDF upload plus inclusion — verify the consumer
Command and Manual SQL Injection
- Operating-system command injection
- Visible-output baseline
- Blind timing proof
- After command execution
- Manual SQL injection workflow
- 1. Establish query influence
- 2. Authentication-bypass candidate
- 3. Determine UNION shape
- 4. Extract only after fingerprinting the DBMS
- 5. Boolean- or time-blind extraction
- Database control to operating-system effect
- Out-of-band SQL injection boundary
- Failure-guided decisions
- Handoffs
- SSTI — prove template evaluation, then identify the engine
- XXE — test the XML parser and file-read result
- NoSQL operator injection — separate JSON objects from strings
- PHP deserialization — match the gadget to installed dependencies
- Unsafe YAML construction — distinguish loading from safe parsing
- SQL truncation or normalization mismatch at registration
- Shellshock candidate — only for a CGI path that invokes vulnerable Bash
Web Access Control, API Logic and XSS
WordPress and SSRF Paths
Public Exploit Selection and Adaptation
- Record the candidate
- Search narrowly
- Audit untrusted code before execution
- Establish the runtime before changing code
- Python exploit workflow
- Compile reviewed source
- Make the smallest supported edit
- Repair a web exploit from the real transaction
- Adapt an existing memory-corruption PoC only as required
- Prove effects in increasing order
- Failure routing
- Handoff and evidence
- Component/CVE lookup from the source cheatsheet
shells transfers credentials
File Transfer
- Linux target: pull LinPEAS from Kali over HTTP
- Serve a fixed directory without changing folders
- Linux target with curl
- Windows target with PowerShell
- Windows alternatives
- Verify the transfer
- Kali to a Linux target
- Linux target to Kali
- SSH key or nonstandard port
- Start an authenticated SMB share on Kali
- Connect and download from Windows
- Upload evidence from Windows to Kali
- Retrieve a file from the target to Kali
- Send a file from Kali to the target
- Encode on Linux
- Decode on Linux
- Decode in PowerShell
- PHP HTTP file server when Python is unavailable
Shells, Payloads and Session Repair
- Keep four states separate
- Choose the access form
- Map the callback before generating anything
- Listener baselines and Netcat variants
- Prove command execution before requesting a shell
- Linux reverse-shell baselines
- Windows session options
- Bind shells
- Generate payloads after selecting context
- Staged versus stageless
- Existing-PoC payload constraints
- Diagnose quoting and encoding by layer
- Diagnose a missing callback in order
- Handle security-control evidence proportionately
- Stabilize a Linux TTY
- Verify every new session
- Failure router
- Exam boundary
- Powercat — Windows PowerShell shell transport
- Penelope or pwncat-cs — handle an existing shell and move files
- Keep listeners and long-running checks in tmux
- ASPX handler check before generating a Windows payload
- Shell alternatives when the installed runtime changes
- OpenSSL transport when a TLS callback is useful
Credential Classification, Cracking and Reuse
- Credential record
- Classify before acting
- Validate one known password
- Estimate feasibility
- Hashcat baseline and meaningful modes
- John the Ripper workflow
- KeePass database
- SSH private-key passphrase
- Linux password records
- NT hash
- Net-NTLMv2 response
- DCC2 / cached domain logon
- Kerberos tickets and caches
- Credential Guard boundary
- Failure routing
- Re-enumerate after success
- Build a small site-specific wordlist with CeWL
- Generate usernames from observed naming conventions
- Targeted candidates — Crunch, CUPP and rules
- Password-protected ZIP — direct test or extracted verifier
- HTTP Basic authentication — validate the challenge and failure signal
- Change an account’s own expired/known SMB password
- Generate a bounded numeric list for an observed identifier pattern
- An application authenticates to your explicit SMB endpoint
File and Repository Hunting
Python Tool Environments
Payload Execution Obstacles
- 1. Preserve the execution chain
- 2. Fast diagnostic order
- 3. Client-side attacks are gated chains
- 3.1 Office macro chain
- 3.2 Windows Library file plus shortcut
- 4. Match artifact to its consumer
- 4.1 Linux checks
- 4.2 Windows checks
- 5. Parser, command-line and length failures
- 6. PowerShell control layers
- 7. Interpret control evidence
- 8. Generate only after selecting the context
- 9. multi/handler and session lifecycle
- 10. Metasploit module workflow and exam boundary
- 11. Worked diagnostic paths
- A. Document delivered, no callback
- B. Executable disappears after transfer
- C. PowerShell says scripts are disabled
- D. Connection reaches Netcat but there is no shell
- E. Binary exists but returns “not found” on Linux
- F. Metasploit module reports completion, no session
- 12. Evidence and cleanup
- Tooling for this section
local privilege escalation
Linux Privilege Escalation
- 1. Establish current state
- 2. Prove permissions, including parents and mounts
- 3. Hunt credentials and service trails
- 4. Sudo: parse the complete rule
- 5. SUID, SGID and capabilities
- 6. Cron, timers and services
- 7. PATH and relative-command hijacking
- 8. Wildcard and option injection
- 9. Writable account/policy files
- 10. Privileged groups, sockets and containers
- 11. Mounts, NFS and local services
- 12. Shared-library resolution
- 13. Software/kernel exploits: evidence last
- 14. Automated enumeration: generate, then prove
- 15. Failure router
- 16. Verify and re-enumerate
- Restricted shell — escape the restriction without claiming root
- Kernel candidates — Linux Exploit Suggester as a second view
- Logrotate race — only with a controlled log path and privileged rotation
Windows Privilege Escalation
- 1. Establish token and host state
- 2. Interpret effective access
- 3. Hunt credentials and configuration
- Stored credentials and PowerShell trails
- 4. Service control and executed objects
- Inventory and inspect
- Modifiable service configuration
- 5. Unquoted service paths
- 6. DLL/config/helper search hijacking
- 7. Scheduled tasks and autostarts
- Scheduled tasks
- 8. AlwaysInstallElevated and UAC context
- 9. Token privilege routes
- 10. Application, driver and kernel candidates
- 11. Automated candidate generation
- 12. Failure router
- 13. Verify, re-enumerate and preserve evidence
- JAWS — PowerShell enumeration when the compiled helper is unsuitable
- Legacy impersonation helpers — select by OS build and trigger
- AccessChk — verify the exact service, file or registry permission
ad lateral movement
Active Directory Domain Mapping
- AD capability transitions
- 1. Keep four maps, not one tool output
- 2. Establish identity, domain, DC, DNS and time
- Domain-joined Windows source
- Kali/off-domain source
- 3. Native Windows baseline
- 4. Built-in ADSI/DirectorySearcher fallback
- 5. Authenticated LDAP from Kali
- Discover the naming context
- Users, groups and computers
- LDAP failure router
- 6. PowerView: convenient manual breadth
- 7. Shares, SYSVOL and NETLOGON
- Inventory, then test the object
- 8. Service accounts and SPNs
- 9. Directory ACLs and effective control
- 10. Host-access candidates
- 11. Sessions are volatile hints
- 12. BloodHound: collect narrowly, rank, then validate
- Current SharpHound CE
- Noninteractive Kali first pass
- Analyze in this order
- 13. Candidate ledger and path ranking
- 14. Failure routing
- 15. Handoffs
- Tooling for this section
- Kerbrute — confirm candidate names before password testing
- RustHound-CE — a cross-platform BloodHound collector
- GPP cpassword — recover a candidate from readable SYSVOL XML
- Kerberos clock skew — compare UTC and use a working time source
Windows and Domain Credential Access
- 1. Select the source before the tool
- 2. Establish privilege and protection state
- 3. Inspect tickets before invasive collection
- 4. LSASS: live logon-session material
- Direct Mimikatz access
- Dump first, parse offline
- 5. SAM and SYSTEM: local identities
- 6. SECURITY and SYSTEM: LSA secrets and cached domain verifiers
- 7. Credential Manager and DPAPI
- 8. NTDS and replication paths
- Offline NTDS from an already controlled DC
- Shadow-copy boundary: inspect before creating anything
- Remote collection
- Credential routing
- 9. Classify before choosing the transition
- Net-NTLMv2 relay is a live authentication path, not hash reuse
- 10. Failure router
- Tooling for this section
- DonPAPI — remote DPAPI/application-secret collection with host rights
Kerberos and Identity Transitions
- 1. Kerberos model and prerequisites
- 2. Password policy and bounded validation
- 3. AS-REP roasting
- Why AS-REP roasting works
- One known user, no password
- Supplied user list, no password
- Authenticated directory-backed discovery
- Windows/Rubeus alternative
- Interpret before cracking
- 4. Kerberoasting
- Why Kerberoasting works
- Enumerate without requesting tickets
- Request one selected user
- Hash type and cracking
- Common failures
- 5. Targeted Kerberoasting from object control
- 6. Ticket inventory, classification and conversion
- 7. Pass-the-Ticket and key-to-ticket transitions
- 8. Silver tickets: forge one service ticket
- 9. Re-enumerate every new identity
- 10. Failure router
- Tooling for this section
- Timeroast — offline recovery of weak computer-account passwords via MS-SNTP
Object Control, AD CS and Domain Compromise
- Directory-object control
- Password reset
- Group membership
- Targeted Kerberoast through SPN write
- Owner and DACL transitions
- Conditional: GPO control
- Conditional: delegation paths
- Resource-based constrained delegation
- Conditional: AD CS enumeration
- Conditional: certificate request and authentication
- Conditional: ESC4/template-write boundary
- DCSync replication rights
- Conditional: high-impact ticket-forging concepts
- bloodyAD — Linux-side LDAP reads and permission-backed writes
- Delegated reads — LAPS and gMSA material
- Shadow credentials — object-key write, PKINIT, then cleanup
- PassTheCert — Schannel/LDAP when the certificate is usable there
- Powermad — create an account only when the chosen AD path needs it
- gMSA — obtain a decoded hash only with managed-password read rights
Lateral Movement
- 1. Choose by credential and service
- 2. Preflight from the actual source
- 3. Validate authentication separately from execution
- 4. SMB and service-control execution
- Impacket PsExec
- Sysinternals PsExec from Windows
- SMBExec
- ATExec
- 5. WMI and DCOM execution
- Impacket WMIExec
- Native PowerShell CIM over DCOM
- DCOM MMC method
- 6. WinRM, WinRS and PowerShell remoting
- Evil-WinRM
- Native WinRS
- PowerShell remoting
- 7. RDP
- 8. Pass-the-Hash, Overpass-the-Hash and Pass-the-Ticket
- Pass-the-Hash
- Overpass-the-Hash / key-to-ticket
- Pass-the-Ticket
- 9. Local versus domain identity and remote UAC
- 10. Output channels, session 0 and double hop
- 11. Failure router
- 12. After movement
- Tooling for this section
- winexe — Samba-side service execution alternative
Conditional AD infrastructure and trust checks
pivoting tunneling
Tunneling and Port Forwarding
- 1. Draw the route before choosing a command
- 2. Discover the pivot's network position
- 3. Choose the smallest compatible route
- 4. Socat fixed TCP relay
- 5. OpenSSH forwarding
- 5.1 Local forward: listener on the SSH client
- 5.2 Dynamic forward: SOCKS listener on the SSH client
- 5.3 Remote forward: listener on the SSH server
- 5.4 Remote dynamic forward: SOCKS listener on the SSH server
- 5.5 SSH jump and proxy command
- 6. ProxyChains and SOCKS-aware clients
- 7. sshuttle transparent selected-subnet route
- 8. Windows forwarding alternatives
- 8.1 Built-in OpenSSH client
- 8.2 Plink
- 8.3 Netsh portproxy
- 9. Chisel HTTP/WebSocket tunnel
- 9.1 Reverse SOCKS: pivot initiates outward
- 9.2 Reverse fixed TCP forward
- 9.3 Forward SOCKS when the client is on the tool side
- 9.4 Current UDP-aware mode
- 9.5 Chisel failure cues
- 10. Ligolo-ng routed pivot
- 10.1 Proxy and agent
- 10.2 Current managed interface and route
- 10.3 Pivot loopback services
- 10.4 Callback or file-server listener on the agent
- 11. DNS and Kerberos across pivots
- 12. Callback and delivery routing
- 13. Multi-hop routes
- 14. DNS tunneling with dnscat2
- 15. Failure router
- 16. Verification and cleanup
- Tooling for this section
- Exam restriction
evidence reporting
Integrated Attack Tracking and Evidence
- Establish the operating contract
- Maintain a live state map
- Run the attack as a state machine
- Keep two queues
- Rank candidate paths
- Standalone attack workflow
- Assumed-breach AD workflow
- Capture every state transition
- Save tool output deliberately
- Proof/evidence checkpoint
- Public exploit evidence
- Reproduction-path template
- Dead-end recovery
- Build the report from transitions
- Final PDF and archive validation
- Final quality checks
- Tooling for this section